Resubmissions
13/02/2022, 03:26
220213-dy59eafben1025/06/2021, 19:08
210625-fml1gypkn6819/06/2021, 15:14
210619-d3391n953n10Analysis
- max time kernel
300s - max time network
303s - platform
windows10_x64 - resource
win10v20210410 - submitted
19/06/2021, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
Tray.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tray.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target Tray.exe
- Size 321KB
- Sample210619-d3391n953n
- SHA256 e07b0cd7eca5bc70b07ea786c3ef4da28036c901effa2193a93caf945cb2b334
- MD5 6585cb51ff21007fb9ef936e96c58982
- SHA1 7a3d5563460b9935fe84879ee14fabfc7c664825
- SHA512 523c7b3ed0907a473eac04c8cb8642eeea1d3a223069f876a7e0bc18075d59f9903319f6b2e3c2fa262158f04c4ad3637568dd9b0558732c8a574ffe566efc7d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\gm.dls Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\fwpkclnt.sys.mui Tray.exe - Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ReceiveSuspend.tiff Tray.exe - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Tray.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Contacts\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Tray.exe File opened for modification C:\Windows\Web\Wallpaper\Theme2\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.15063.0_none_0437af998b0e208e\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.15063.0_none_eb7f363ab6175c3e\Desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Tray.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.15063.0_none_19586abacce7785e\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_a64d6b3dd0267b2d\Desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.15063.0_none_7c2bbc3db7cbacf0\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Tray.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Tray.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Tray.exe File opened for modification C:\Windows\Media\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_026c06c18883ec63\Desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Tray.exe File opened for modification C:\Users\Public\desktop.ini Tray.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.15063.0_none_af9971bc2c6c0486\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.15063.0_none_5fe51e9b01006347\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.15063.0_none_5fa2753162f86404\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.15063.0_none_662bd76b47731007\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.15063.0_none_e7edc57dddbcc561\Desktop.ini Tray.exe File opened for modification C:\Windows\Fonts\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.15063.0_none_033cfedce922e911\desktop.ini Tray.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Tray.exe File opened for modification C:\Windows\Offline Web Pages\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.15063.0_none_93939f0ae8aadf65\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Links\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu Places\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.15063.0_none_5211b42e358da2ca\desktop.ini Tray.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.15063.0_none_31bf86f81c563119\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.15063.0_none_6fae0d35d5f5cd29\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.15063.0_none_ed59e293474a6cb5\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Music\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.15063.0_none_91663737b60fa4f6\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.15063.0_none_0d24170c83d741b6\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.15063.0_none_681472142b50e5ab\desktop.ini Tray.exe - Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\downlevel\API-MS-Win-EventLog-Legacy-L1-1-0.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0LXPS-manifest.ini Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\storufs.inf_amd64_f25a0ad42f53c0f2\storufs.sys Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\CNQ9604\CNQ_412N.DAT Tray.exe File opened for modification C:\Windows\SysWOW64\ko-KR\comctl32.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\UevCustomActionTypes.tlb Tray.exe File opened for modification C:\Windows\SysWOW64\mscorier.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Lxss-Optional-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-WaaSAssessment-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\SysWOW64\sk-SK\mlang.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\wbem\en-US\netswitchteamcim.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\C_ISCII.DLL Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WCN-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DeviceGuard-GPEXT-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnokcl2.inf_amd64_1e45a4f567fdae98\OKV4PCL6-PipelineConfig.xml Tray.exe File opened for modification C:\Windows\SysWOW64\hu-HU\comdlg32.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\lsmproxy.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\en-US\ndiscap.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\Windows.Devices.SmartCards.Phone.dll Tray.exe File opened for modification C:\Windows\SysWOW64\wbem\portabledevicetypes.mof Tray.exe File opened for modification C:\Windows\SysWOW64\mfdvdec.dll Tray.exe File opened for modification C:\Windows\SysWOW64\downlevel\API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_89ad35ab63ac1a22\oposdrv.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_68d37c01f27b5d51\urssynopsys.sys Tray.exe File opened for modification C:\Windows\SysWOW64\Windows.UI.XamlHost.dll Tray.exe File opened for modification C:\Windows\SysWOW64\Windows.Devices.Picker.dll Tray.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\rdrleakdiag.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\C_20871.NLS Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlclw.inf_amd64_22943612af676c5d\DLclW0.GPD Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\Robocopy.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\tsgqec.dll Tray.exe File opened for modification C:\Windows\SysWOW64\ntmarta.dll Tray.exe File opened for modification C:\Windows\SysWOW64\wbem\en-US\wsp_health.mfl Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\auditpol.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\tlscsp.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShellExperienceHost-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_e77733cbee7e6db0\SDFLauncher.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0LXGPW.GPD Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\MFC42.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\scesrv.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnms008.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_6220551ad98f242c\c_mediumchanger.inf Tray.exe File opened for modification C:\Windows\SysWOW64\KBDTH2.DLL Tray.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PushNotifications-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\scksp.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\MSFT_ServiceResource.schema.mfl Tray.exe File opened for modification C:\Windows\SysWOW64\sdiageng.dll Tray.exe File opened for modification C:\Windows\SysWOW64\sc.exe Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\sysdm.cpl.mui Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_0373-MANIFEST.INI Tray.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\NETJME.sys Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_abe96c8dcb5b0eac\netwlv64.inf Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\evr.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\F12\Timeline.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-WWA-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_0381.GPD Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\systeminfo.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\oledlg.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\playtomenu.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_b51edb2b9055d904\wdmaudio.inf Tray.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\App.xbf Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..dataretrievalclient_31bf3856ad364e35_10.0.15063.0_none_d59f603cdc0f5dd4\DeviceMetadataRetrievalClient.dll Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..oyment-languagepack_31bf3856ad364e35_10.0.15063.0_en-us_975e552ebfcd4f8f.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-d..s-ntdsatq.resources_31bf3856ad364e35_10.0.15063.0_en-us_d9b20db471ef320a.manifest Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_39f63523d36ade56\tipresx.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-security-ngc-keyenum_31bf3856ad364e35_10.0.15063.0_none_0b2128b5cdd4b6b7\ngckeyenum.dll Tray.exe File opened for modification C:\Windows\WinSxS\msil_system.workflow.activities_31bf3856ad364e35_4.0.15552.17062_none_34ec3a6631ad20d8\System.Workflow.Activities.dll Tray.exe File opened for modification C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.15063.0_none_25273e3a8c447964\caspol.exe.config Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\WideTile.scale-200.png Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_mdmkortx.inf_31bf3856ad364e35_10.0.15063.0_none_110435fed978cf3f\mdmkortx.inf Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-onecore-c..ehost-api.resources_31bf3856ad364e35_10.0.15063.0_en-us_35824dc08aa68f34.manifest Tray.exe File opened for modification C:\Windows\WinSxS\amd64_devicepairingproxy_31bf3856ad364e35_10.0.15063.0_none_4181eb4d4ea17d29\DevicePairingProxy.dll Tray.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_diagnostics_system_windowsmediaplayermedialibrary_64611465e9119df8.cdf-ms Tray.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_10.0.15063.0_none_2a54cb2e6829ec2c\netscape.browser Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.15063.0_none_39384d9f3be72de5.manifest Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\mooning.png Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-200.png Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-RasRip-Package~31bf3856ad364e35~amd64~~10.0.15063.0.mum Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c...appxmain.resources_31bf3856ad364e35_10.0.15063.0_mt-mt_f60a7c04849063ad\resources.mt-MT.pri Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-font-truetype-taile_31bf3856ad364e35_10.0.15063.0_none_9c7277e4e86517c8.manifest Tray.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-sysdm_31bf3856ad364e35_10.0.15063.0_none_17777074f5ae2032\sysdm.cpl Tray.exe File opened for modification C:\Windows\Boot\PCAT\ja-JP\memtest.exe.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_wiaca00j.inf_31bf3856ad364e35_10.0.15063.0_none_53a73a8467cc268a\amd64\MG8200\CNC_391W.DAT Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..owsercore.resources_31bf3856ad364e35_10.0.15063.0_en-us_0e60559c58a2749b.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-offlinefiles-adm_31bf3856ad364e35_10.0.15063.0_none_6acc63d7d131aec3.manifest Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mfc42x_31bf3856ad364e35_10.0.15063.0_none_0428a77a8e5d7282\mfc42.dll Tray.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_et-ee_51c0f1bb9bbbf098_msimsg.dll.mui_72e8994f Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\x86_netfx-sbs_sys_enterprisesvc_dll_31bf3856ad364e35_10.0.15063.0_none_161e9740a642ecc4.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-r..o-service.resources_31bf3856ad364e35_10.0.15063.0_en-us_91bc4535c98b7109.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.xsd Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-ShareMedia-ControlPanel-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\MicrosoftEdgeSquare44x44.targetsize-48.png Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-edp-task_31bf3856ad364e35_10.0.15063.0_none_0415d1484f341717\@edptoastimage.png Tray.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_help_b03f5f7f11d50a3a_4.0.14917.0_none_c1711919101c2eef\WebAdminHelp_Internals.aspx Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.15063.0_none_6aac5ddef84ce0a1.manifest Tray.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-mscorlib_ni_b03f5f7f11d50a3a_4.0.14917.0_none_3721d027b2986727\mscorlib.ni.dll Tray.exe File opened for modification C:\Windows\diagnostics\system\Networking\HTInteractiveRes.ps1 Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-snmp-evntcmd.resources_31bf3856ad364e35_10.0.15063.0_en-us_e59ec39c350a7f4b.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.15063.0_en-us_d2c62b90da3c564e.manifest Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\Fonts\MsgMDL2.ttf Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_mdmvv.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_a459c0cc1d35407d.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.resx Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-msidntld_31bf3856ad364e35_10.0.15063.0_none_fb9b797c675265bb.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PenIMC.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-adm.resources_31bf3856ad364e35_10.0.15063.0_en-us_990051dd391487d9\COM.adml Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.15063.0_none_5eb55a9a4356bc39\DefaultSystemNotification.contrast-white_scale-200.png Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.15063.0_none_7817d3bd3211492c.manifest Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..etoolsgui.resources_31bf3856ad364e35_10.0.15063.0_en-us_669d6b237c8977e3\wvc.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_networking-mpssvc-netsh-tracing_31bf3856ad364e35_10.0.15063.0_none_a3b8db13ff97bd68\authfwcfg.mof Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.15063.0_en-us_178e7fdce2e453a7.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.15063.0_none_6cd5a5d60e5909d1.manifest Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_altform-unplated.png Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\blushing.png Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ne_60x42.png Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\daily_challenge.jpg Tray.exe File opened for modification C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_ef9cc294168a8b97.cdf-ms Tray.exe File opened for modification C:\Windows\Fonts\phagspa.ttf Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-Containers-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.mum Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.15063.0_none_2bd1e3a1cfd67be0\logo.scale-400_altform-unplated.png Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..s-classicsearchdata_31bf3856ad364e35_10.0.15063.0_none_2bf46985bc0de379\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms Tray.exe File opened for modification C:\Windows\WinSxS\amd64_prnhpcl4.inf_31bf3856ad364e35_10.0.15063.0_none_0990f26dfbfb201c\amd64\hpipcl3at.gpd Tray.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_10.0.15063.0_en-us_776a0f4c462a25fa\pegi.rs.mui Tray.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4788 werfault.exe Token: SeBackupPrivilege 4788 werfault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tray.exe"C:\Users\Admin\AppData\Local\Temp\Tray.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
PID:4092
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\b788965c6bb147ed9dc35498be823c95 /t 4012 /p 40921⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788